I just ran a general sweep of my system with Spy Sweeper 4.5.9. It coughed out the following:
...
6:00 AM: Found System Monitor: potentially rootkit-masked files
6:00 AM: copying (ID = 0)
6:00 AM: main.hdb (ID = 0)
6:00 AM: main.ndb (ID = 0)
6:00 AM: main.fp (ID = 0)
<<and several more>>
...

These are evidently ClamWin files. So I let SpySweeper delete them on reboot. Clamwin still seems to be working OK.

Can anyone tell me what is going on and how to avoid any problems.
Thanks

Spy Sweeper 4.5.9 mistakenly consideres clamwin temprorary files as rootkit-masked. These files have ID=0 because of cygwin unix compatibility layer used in windows. Removing those files will do no harm.